Vendors · AI applications · Cursor
Cursor says Privacy Mode keeps customer data out of training
Cursor, by Anysphere. Each line below quotes Cursor’s own pages as kept on 3 Nov 2026.
Cursor’s questionnaire: nine buyer questions, each answered from these pages.
Cursor’s record as an AI bill of materials: CycloneDX · SPDX. Not signed.
Cursor’s status history: every incident on its status page, kept from its own feed.
What the pages say
each value, then the words it is read from- Training on business and API data
- Not with Privacy Mode on
-
If you choose to turn off “Privacy Mode”: we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.
With Privacy Mode on: “Customer Data will not be used for training by Cursor.” The page does not say which setting is the default. Data Use & Privacy Overview, kept 26 Oct 2026 · sha256
3c9ff56d3aa0 - How long API data is kept
- Not stated in the pages kept
- Searched: Data Use & Privacy Overview; Security; Models and pricing; Data Processing Addendum.
- Option to keep no data
- With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation
-
Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.
The same paragraph: “Non-ZDR models will be designated as such or require an admin to opt-in to enable the model for your workspace.” Abuse detectors can keep data for investigation. Data Use & Privacy Overview, kept 26 Oct 2026 · sha256
3c9ff56d3aa0 - Where data is processed and stored
- No infrastructure in China
-
Cursor does not use or maintain any infrastructure in China.
Security, kept 26 Oct 2026 · sha256
66d02e9bb248 - Sub-processors
- Listed on its trust portal; none headquartered in China
-
Our list of subprocessors is published on our trust portal.
The same section adds: “We do not use any companies headquartered in China as subprocessors, and to our knowledge none of our subprocessors do either.” Security, kept 26 Oct 2026 · sha256
66d02e9bb248 - Certifications and audits
- SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1
-
Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation.
Security, kept 26 Oct 2026 · sha256
66d02e9bb248 - Data processing agreement
- Published; governs processing under the Master Services Agreement
-
This Data Processing Addendum (“DPA”) governs Anysphere, Inc.’s (“Anysphere” or “Vendor”) processing of Personal Data provided by Customer through the Service, in accordance with the Master Services Agreement between Anysphere and Customer (“Agreement”).
Data Processing Addendum, kept 3 Nov 2026 · sha256
95face0c2e6c - Published usage limits
- A weekly pool of usage for Cursor models on each paid plan; third-party models on Premium and above at API list price
-
Each paid plan includes one pool of usage for Cursor models.
The page says the pool “refreshes weekly, so one heavy day doesn't use up your month.” It also says: “Plus and Free don't include third-party models.” Models and pricing, kept 3 Nov 2026 · sha256
cb5ece5b5229
Pages kept
each copy is held with the sha256 of its bytes as served| Page | The page’s date | Newest copy | Checks |
|---|---|---|---|
| Data Use & Privacy OverviewTraining and retention, by Privacy Mode | Last updated September 3, 2026 | 26 Oct 2026, 133 KBsha256 3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e |
|
| SecurityCertifications, subprocessors and Privacy Mode | Last updated August 25, 2026 | 26 Oct 2026, 149 KBsha256 66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134 |
|
| Models and pricingPlans, included usage and limits | none printed | 3 Nov 2026, 383 KBsha256 cb5ece5b5229ffe067d8af2f829bb180001455896812b687547282a8d90c9cb7 |
|
| Data Processing AddendumThe data processing addendum | Last updated November 5, 2025 | 3 Nov 2026, 196 KBsha256 95face0c2e6cc4f05737d9bb2e3cd43b7ab6f2497cf8c761abd7620e7f24e044 |
|
No kept page of Cursor has changed
first kept on 26 Oct 2026Sources
vendors.csv Every dataset → Status → Glossary →- Cursor, Data Use & Privacy Overview, kept 26 Oct 2026.
- Cursor, Security, kept 26 Oct 2026.
- Cursor, Models and pricing, kept 3 Nov 2026.
- Cursor, Data Processing Addendum, kept 3 Nov 2026.